These are the companies that process personal data for us. Customers: under the DPA we email you at least 30 days before adding or replacing a subprocessor. The Privacy Policy explains how transfers outside the EU are protected.
Subprocessors
| Provider | What for | Data | Location |
|---|---|---|---|
| Contabo GmbH | Servers, database and file storage for the whole service | All data in the service | European Union (Germany) |
| Backblaze B2 (Backblaze, Inc.) | Off-site storage for the nightly backups of the database and uploaded files | All data in the service, encrypted on our servers before upload. Backblaze cannot read it | European Union (Netherlands) |
| Resend (Resend, Inc.) | Sending account emails: sign-in, verification, password reset, invitations, billing notices | Recipient email address, email content | United States |
| ZeptoMail (Zoho Corporation) | Sending notification emails to board followers, and account emails as a fallback | Recipient email address, email content | European Union or United States, depending on the account region |
| Google Analytics (Google Ireland Ltd / Google LLC) | Website analytics on upvotekit.com, only with consent. Never on customer boards or embeds | Page path, a few funnel events, a browser identifier (cookie) | European Union and United States |
| Cloudflare Turnstile (Cloudflare, Inc.) | Spam protection: checks that a visitor is human before they post, comment or leave their email on a board, or join the launch waitlist | IP address and browser signals of the visitor, while the check runs. We receive only pass or fail | Worldwide (Cloudflare network), United States |
Independent controllers
These companies decide themselves how they use the data they receive, under their own privacy policies.
| Provider | What for | Data | Location |
|---|---|---|---|
| Paddle (Paddle.com Market Ltd and affiliates) | Merchant of record: sells the subscription, takes payment, handles tax, invoices and refunds | Name, email, billing address, payment details | United Kingdom, with processing in the EU and US |
| Google (Sign in with Google) | Signing in, only if you choose it | Your Google account id, name, email, profile picture | United States and elsewhere |
Integrations you connect yourself, such as Slack, Discord or your own webhooks, receive the data you choose to send them. They are your providers, not ours.